The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from email senders, subjects, and bodies which may contain adversarial instructions.
Ingestion points: Untrusted data enters the agent context through tools in scripts/pst_client.py such as get_latest_emails, search_emails_by_subject, and extract_pst.
Boundary markers: None identified. The instructions do not provide delimiters or instructions for the agent to ignore potentially malicious content embedded within the emails.
Capability inventory: The skill possesses capabilities to write files to the host machine (via draft_email --out-path) and perform network operations to a local MCP server.
Sanitization: There is no evidence of content sanitization or filtering before external email data is interpolated into the agent's context.
[DATA_EXFILTRATION]: The skill facilitates the extraction of sensitive mailbox information, including full email dumps and contact lists, transmitting this data from the host machine to an internal network endpoint at http://host.openshell.internal:9003/mcp.
[EXTERNAL_DOWNLOADS]: The troubleshooting section in SKILL.md instructs the user or agent to install the fastmcp package from the Python Package Index (PyPI) if dependencies are missing.
[COMMAND_EXECUTION]: The skill requires the execution of a Python script (scripts/pst_client.py) to bridge communication between the sandbox and the host-based MCP server, exposing host-side file system operations like saving email drafts.

pst-mail-skills